AWS Secrets Manager Lambda layer

Open in ChatGPTOpen in Claude

By default, a Coralogix AWS integration reads its API key from a Lambda environment variable, where anyone with read access to the function can see it. The Secrets Manager Lambda layer moves the key into AWS Secrets Manager and has the function fetch it at runtime instead.

The layer works with any of the Coralogix AWS integrations. Deploy it once, then pass its ARN to each integration that should use it. You can deploy it as a serverless application or with Terraform.

What you need

• An AWS account with permissions to create Lambda layers and Secrets Manager secrets.
• A Coralogix Send-Your-Data API key.

Deploy as a serverless application

1.

Open the application

Go to the Coralogix Lambda SSM layer in the AWS Serverless Application Repository and select Deploy.

2.

Review the application settings

Confirm the Application name, CompatibleRuntimes, and RetentionPolicy, then select Deploy.

Shows the settings the layer is created with, and the Deploy button that creates it.

3.

Wire the layer into an integration

Once the layer exists, copy its ARN into the LayerARN field of the integration that should use it.

Shows where the layer ARN is supplied to a downstream integration.

Deploy with Terraform

1.

Create the layer

Apply this configuration and note the layer_arn output:

provider "aws" {
}

module "lambda-secretLayer" {
  source = "coralogix/aws/coralogix//modules/lambda-secretLayer"
}

output "layer_arn" {
  value = module.lambda-secretLayer.lambda_layer_version_arn
}

2.

Reference it from an integration

Pass the ARN as layer_arn and set secret_manager_enabled to true. Coralogix creates the secret from the private_key value you supply:

provider "aws" {
}

module "lambda-secretLayer" {
  source = "coralogix/aws/coralogix//modules/lambda-secretLayer"
}

module "coralogix-shipper-s3" {
  source = "coralogix/aws/coralogix//modules/s3"
  depends_on = [ module.lambda-secretLayer ]

  coralogix_region       = "Europe"
  private_key            = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXX"
  secret_manager_enabled = true
  layer_arn              = module.lambda-secretLayer.lambda_layer_version_arn
  application_name       = "s3"
  subsystem_name         = "logs"
  s3_bucket_name         = "test-bucket-name"
  integration_type       = "s3"
}

Use a secret you already have

To point the integration at an existing secret rather than creating one, set create_secret to False and pass the secret's name as private_key.

provider "aws" {
}

module "lambda-secretLayer" {
  source = "coralogix/aws/coralogix//modules/lambda-secretLayer"
}

module "coralogix-shipper-s3" {
  source = "coralogix/aws/coralogix//modules/s3"
  depends_on = [ module.lambda-secretLayer ]

  coralogix_region   = "Europe"
  private_key        = "the name of the secret that contains the Coralogix send your data key"
  layer_arn          = module.lambda-secretLayer.lambda_layer_version_arn
  application_name   = "s3"
  subsystem_name     = "logs"
  s3_bucket_name     = "test-bucket-name"
  integration_type   = "s3"
  create_secret      = "False"
}

Related resources

Coralogix AWS Shipper data collection optionsAWS CloudWatch data collection optionsSend-Your-Data API key