# AWS Secrets Manager Lambda layer

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Faws%2Faws-secrets-manager-lambda-layer.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Faws%2Faws-secrets-manager-lambda-layer.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

By default, a Coralogix AWS integration reads its API key from a Lambda environment variable, where anyone with read access to the function can see it. The Secrets Manager Lambda layer moves the key into [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/) and has the function fetch it at runtime instead.

The layer works with any of the Coralogix AWS integrations. Deploy it once, then pass its ARN to each integration that should use it. You can deploy it as a serverless application or with Terraform.

## What you need [​](#what-you-need- "Direct link to what-you-need-")

* An AWS account with permissions to create Lambda layers and Secrets Manager secrets.
* A Coralogix [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md).

## Deploy as a serverless application [​](#deploy-as-a-serverless-application- "Direct link to deploy-as-a-serverless-application-")

1

<!-- -->

.

Open the application

Go to the [Coralogix Lambda SSM layer](https://serverlessrepo.aws.amazon.com/applications/eu-central-1/597078901540/Coralogix-Lambda-SSMLayer) in the AWS Serverless Application Repository and select **Deploy**.

2

<!-- -->

.

Review the application settings

Confirm the **Application name**, **CompatibleRuntimes**, and **RetentionPolicy**, then select **Deploy**.

[![AWS application settings page for the Coralogix Lambda SSM layer with application name, compatible runtimes, and retention policy](/docs/assets/images/2-1-1024x742-87a9322a95e5b8801e24973b39d26c93.webp)](https://coralogix.com/docs/assets/images/2-1-1024x742-87a9322a95e5b8801e24973b39d26c93.webp)

Shows the settings the layer is created with, and the Deploy button that creates it.

3

<!-- -->

.

Wire the layer into an integration

Once the layer exists, copy its ARN into the **LayerARN** field of the integration that should use it.

[![Integration deployment form with the LayerARN field and the IAM acknowledgement checkbox](/docs/assets/images/3-1-1024x332-d641869d3f831d8631b1c3f96561d83d.webp)](https://coralogix.com/docs/assets/images/3-1-1024x332-d641869d3f831d8631b1c3f96561d83d.webp)

Shows where the layer ARN is supplied to a downstream integration.

## Deploy with Terraform [​](#deploy-with-terraform- "Direct link to deploy-with-terraform-")

1

<!-- -->

.

Create the layer

Apply this configuration and note the `layer_arn` output:

```
provider "aws" {

}



module "lambda-secretLayer" {

  source = "coralogix/aws/coralogix//modules/lambda-secretLayer"

}



output "layer_arn" {

  value = module.lambda-secretLayer.lambda_layer_version_arn

}
```

2

<!-- -->

.

Reference it from an integration

Pass the ARN as `layer_arn` and set `secret_manager_enabled` to `true`. Coralogix creates the secret from the `private_key` value you supply:

```
provider "aws" {

}



module "lambda-secretLayer" {

  source = "coralogix/aws/coralogix//modules/lambda-secretLayer"

}



module "coralogix-shipper-s3" {

  source = "coralogix/aws/coralogix//modules/s3"

  depends_on = [ module.lambda-secretLayer ]



  coralogix_region       = "Europe"

  private_key            = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXX"

  secret_manager_enabled = true

  layer_arn              = module.lambda-secretLayer.lambda_layer_version_arn

  application_name       = "s3"

  subsystem_name         = "logs"

  s3_bucket_name         = "test-bucket-name"

  integration_type       = "s3"

}
```

### Use a secret you already have[​](#use-a-secret-you-already-have "Direct link to Use a secret you already have")

To point the integration at an existing secret rather than creating one, set `create_secret` to `False` and pass the secret's **name** as `private_key`.

```
provider "aws" {

}



module "lambda-secretLayer" {

  source = "coralogix/aws/coralogix//modules/lambda-secretLayer"

}



module "coralogix-shipper-s3" {

  source = "coralogix/aws/coralogix//modules/s3"

  depends_on = [ module.lambda-secretLayer ]



  coralogix_region   = "Europe"

  private_key        = "the name of the secret that contains the Coralogix send your data key"

  layer_arn          = module.lambda-secretLayer.lambda_layer_version_arn

  application_name   = "s3"

  subsystem_name     = "logs"

  s3_bucket_name     = "test-bucket-name"

  integration_type   = "s3"

  create_secret      = "False"

}
```

## Related resources[​](#related-resources "Direct link to Related resources")

[Coralogix AWS Shipper data collection options](https://coralogix.com/docs/external/coralogix-aws-shipper)[AWS CloudWatch data collection options](https://coralogix.com/docs/integrations/aws/aws-cloudwatch/aws-cloudwatch-data-collection-options.md)[Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md)