Wanted to use AWS Secrets manager to login to postgres without using username and password as a plain text. i am not sure if this is doable, please forgive me if not. Currently this is what i am using to login to postgres using psycopg2:
import psycopg2
conn = psycopg2.connect(host="hostname",port='5432',database="db", user="admin", password="12345")
i've already stored the username and password in secrets manager but not sure how to use it here. Please help
You can store your credentials (username/password) in SecretsManager using the console. You can store them as key value pairs, for example -
{ "username": "admin", "password": "12345" }
To use this in your Python script, you could do something like this -
session = boto3.session.Session()
client = session.client(
service_name='secretsmanager',
region=< region_name >
)
secret = client.get_secret_value(
SecretId=secret_name
)
secret_dict = json.loads(secret['SecretString'])
username = secret_dict['username']
passw = secret_dict['password']
conn = psycopg2.connect(host="hostname",port='5432',database="db", user=username, password=passw)
Note that this is a simplified example without error handling. You also need to fill in the right region in place of < region_name > in the example.
region_name. e.g. session.client(service_name='', region_name='')You should use the below process:
Below is the sample python script provided by amazon:
import boto3
import base64
from botocore.exceptions import ClientError
def get_secret():
secret_name = "<<{{MySecretName}}>>"
region_name = "<<{{MyRegionName}}>>"
# Create a Secrets Manager client
session = boto3.session.Session()
client = session.client(
service_name='secretsmanager',
region_name=region_name
)
# In this sample we only handle the specific exceptions for the 'GetSecretValue' API.
# See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
# We rethrow the exception by default.
try:
get_secret_value_response = client.get_secret_value(
SecretId=secret_name
)
except ClientError as e:
if e.response['Error']['Code'] == 'DecryptionFailureException':
# Secrets Manager can't decrypt the protected secret text using the provided KMS key.
# Deal with the exception here, and/or rethrow at your discretion.
raise e
elif e.response['Error']['Code'] == 'InternalServiceErrorException':
# An error occurred on the server side.
# Deal with the exception here, and/or rethrow at your discretion.
raise e
elif e.response['Error']['Code'] == 'InvalidParameterException':
# You provided an invalid value for a parameter.
# Deal with the exception here, and/or rethrow at your discretion.
raise e
elif e.response['Error']['Code'] == 'InvalidRequestException':
# You provided a parameter value that is not valid for the current state of the resource.
# Deal with the exception here, and/or rethrow at your discretion.
raise e
elif e.response['Error']['Code'] == 'ResourceNotFoundException':
# We can't find the resource that you asked for.
# Deal with the exception here, and/or rethrow at your discretion.
raise e
else:
# Decrypts secret using the associated KMS CMK.
# Depending on whether the secret is a string or binary, one of these fields will be populated.
if 'SecretString' in get_secret_value_response:
secret = get_secret_value_response['SecretString']
else:
decoded_binary_secret = base64.b64decode(get_secret_value_response['SecretBinary'])
# Your code goes here.
