aws-lambda-secrets 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Some Important Company
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,3 @@
+# aws-lambda-secrets
+
+Fetch secrets from AWS Secrets Manager or Parameter Store during Lambda's runtime.

package/dist/index.js

@@ -0,0 +1,2 @@
+"use strict";var m=Object.defineProperty;var w=Object.getOwnPropertyDescriptor;var p=Object.getOwnPropertyNames;var E=Object.prototype.hasOwnProperty;var P=(t,r)=>{for(var e in r)m(t,e,{get:r[e],enumerable:!0})},T=(t,r,e,a)=>{if(r&&typeof r=="object"||typeof r=="function")for(let n of p(r))!E.call(t,n)&&n!==e&&m(t,n,{get:()=>r[n],enumerable:!(a=w(r,n))||a.enumerable});return t};var b=t=>T(m({},"__esModule",{value:!0}),t);var C={};P(C,{getParameterString:()=>B,getSecretBinary:()=>O,getSecretJSON:()=>V,getSecretString:()=>S});module.exports=b(C);async function f(t,{timeout:r}){let e=new AbortController,a=setTimeout(()=>e.abort(new Error("E_TIMEOUT")),r),n=new URL("http://localhost:2773/secretsmanager/get");n.searchParams.set("secretId",t);try{let s=await fetch(n,{method:"GET",headers:{"X-Aws-Parameters-Secrets-Token":process.env.AWS_SESSION_TOKEN??""},signal:e.signal});if(!s.ok){let u=await s.text().catch(()=>"");throw new Error(`Extension error ${s.status}: ${u.slice(0,200)}`)}let o=await s.json();return{string:o?.SecretString,binary:o?.SecretBinary?Buffer.from(o?.SecretBinary):void 0}}finally{clearTimeout(a)}}async function l(t,{timeout:r}){let e=new AbortController,a=setTimeout(()=>e.abort(new Error("E_TIMEOUT")),r),n=new URL("http://localhost:2773/systemsmanager/parameters/get");n.searchParams.set("name",t);try{let s=await fetch(n,{method:"GET",headers:{"X-Aws-Parameters-Secrets-Token":process.env.AWS_SESSION_TOKEN??""},signal:e.signal});if(!s.ok){let u=await s.text().catch(()=>"");throw new Error(`Extension error ${s.status}: ${u.slice(0,200)}`)}return(await s.json())?.Parameter?.Value}finally{clearTimeout(a)}}var i=require("@aws-sdk/client-secrets-manager"),c=require("@aws-sdk/client-ssm"),h=new i.SecretsManagerClient,x=new c.SSMClient;async function g(t){let r=await h.send(new i.GetSecretValueCommand({SecretId:t}));return{string:r?.SecretString,binary:r?.SecretBinary?Buffer.from(r?.SecretBinary):void 0}}async function y(t){return(await x.send(new c.GetParameterCommand({Name:t})))?.Parameter?.Value}var d=75;async function S(t,r){try{let e=await f(t,{timeout:r?.timeout||d});if(typeof e?.string=="string")return e.string}catch{let e=await g(t);if(typeof e?.string=="string")return e.string}}async function O(t,r){try{let e=await f(t,{timeout:r?.timeout||d});if(e?.binary instanceof Buffer)return e.binary}catch{let e=await g(t);if(e?.binary instanceof Buffer)return e.binary}}async function V(t,r){let e=await S(t,r);return e?JSON.parse(e):void 0}async function B(t,r){try{let e=await l(t,{timeout:r?.timeout||d});if(typeof e=="string")return e}catch{let e=await y(t);if(typeof e=="string")return e}}0&&(module.exports={getParameterString,getSecretBinary,getSecretJSON,getSecretString});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/extension.ts","../src/sdk.ts"],"sourcesContent":["import { getSecretValueFromExtension, getParameterValueFromExtension } from './extension';\nimport { getSecretValue, getParameterValue } from './sdk';\n\nconst EXT_DEFAULT_TIMEOUT = 75; // ms\n\nexport async function getSecretString(\n  id: string,\n  opts?: {\n    timeout?: number;\n  },\n): Promise<string | undefined> {\n  try {\n    const res = await getSecretValueFromExtension(id, {\n      timeout: opts?.timeout || EXT_DEFAULT_TIMEOUT,\n    });\n\n    if (typeof res?.string === 'string') {\n      return res.string;\n    }\n  } catch {\n    const res = await getSecretValue(id);\n\n    if (typeof res?.string === 'string') {\n      return res.string;\n    }\n  }\n\n  return undefined;\n}\n\nexport async function getSecretBinary(\n  id: string,\n  opts?: {\n    timeout?: number;\n  },\n): Promise<Buffer | undefined> {\n  try {\n    const res = await getSecretValueFromExtension(id, {\n      timeout: opts?.timeout || EXT_DEFAULT_TIMEOUT,\n    });\n\n    if (res?.binary instanceof Buffer) {\n      return res.binary;\n    }\n  } catch {\n    const res = await getSecretValue(id);\n\n    if (res?.binary instanceof Buffer) {\n      return res.binary;\n    }\n  }\n\n  return undefined;\n}\n\nexport async function getSecretJSON<T = unknown>(\n  id: string,\n  opts?: {\n    timeout?: number;\n  },\n): Promise<T | undefined> {\n  const value = await getSecretString(id, opts);\n  return value ? (JSON.parse(value) as T) : undefined;\n}\n\nexport async function getParameterString(\n  id: string,\n  opts?: {\n    timeout?: number;\n  },\n): Promise<string | undefined> {\n  try {\n    const res = await getParameterValueFromExtension(id, {\n      timeout: opts?.timeout || EXT_DEFAULT_TIMEOUT,\n    });\n\n    if (typeof res === 'string') {\n      return res;\n    }\n  } catch {\n    const res = await getParameterValue(id);\n\n    if (typeof res === 'string') {\n      return res;\n    }\n  }\n\n  return undefined;\n}\n","import type { GetSecretValueCommandOutput } from '@aws-sdk/client-secrets-manager';\nimport type { GetParameterCommandOutput } from '@aws-sdk/client-ssm';\n\nexport async function getSecretValueFromExtension(\n  id: string,\n  { timeout }: { timeout: number },\n): Promise<{ string?: string; binary?: Buffer } | undefined> {\n  const ctrl = new AbortController();\n  const t = setTimeout(() => ctrl.abort(new Error('E_TIMEOUT')), timeout);\n\n  const url = new URL('http://localhost:2773/secretsmanager/get');\n  url.searchParams.set('secretId', id);\n\n  try {\n    const res = await fetch(url, {\n      method: 'GET',\n      headers: {\n        // Required: the extension uses your Lambda creds via this header\n        'X-Aws-Parameters-Secrets-Token': process.env.AWS_SESSION_TOKEN ?? '',\n      },\n      signal: ctrl.signal,\n    });\n\n    if (!res.ok) {\n      // Extension is up but this request failed; surface a helpful error\n      const body = await res.text().catch(() => '');\n      throw new Error(`Extension error ${res.status}: ${body.slice(0, 200)}`);\n    }\n\n    const json = (await res.json()) as GetSecretValueCommandOutput;\n    return {\n      string: json?.SecretString,\n      binary: json?.SecretBinary ? Buffer.from(json?.SecretBinary) : undefined,\n    };\n  } finally {\n    clearTimeout(t);\n  }\n}\n\nexport async function getParameterValueFromExtension(\n  id: string,\n  { timeout }: { timeout: number },\n): Promise<string | undefined> {\n  const ctrl = new AbortController();\n  const t = setTimeout(() => ctrl.abort(new Error('E_TIMEOUT')), timeout);\n\n  const url = new URL('http://localhost:2773/systemsmanager/parameters/get');\n  url.searchParams.set('name', id);\n\n  try {\n    const res = await fetch(url, {\n      method: 'GET',\n      headers: {\n        // Required: the extension uses your Lambda creds via this header\n        'X-Aws-Parameters-Secrets-Token': process.env.AWS_SESSION_TOKEN ?? '',\n      },\n      signal: ctrl.signal,\n    });\n\n    if (!res.ok) {\n      // Extension is up but this request failed; surface a helpful error\n      const body = await res.text().catch(() => '');\n      throw new Error(`Extension error ${res.status}: ${body.slice(0, 200)}`);\n    }\n\n    const json = (await res.json()) as GetParameterCommandOutput;\n    return json?.Parameter?.Value;\n  } finally {\n    clearTimeout(t);\n  }\n}\n","import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';\nimport { SSMClient, GetParameterCommand } from '@aws-sdk/client-ssm';\n\nconst secrets = new SecretsManagerClient();\nconst ssm = new SSMClient();\n\nexport async function getSecretValue(id: string): Promise<{ string?: string; binary?: Buffer } | undefined> {\n  const res = await secrets.send(\n    new GetSecretValueCommand({\n      SecretId: id,\n    }),\n  );\n\n  return {\n    string: res?.SecretString,\n    binary: res?.SecretBinary ? Buffer.from(res?.SecretBinary) : undefined,\n  };\n}\n\nexport async function getParameterValue(id: string): Promise<string | undefined> {\n  const res = await ssm.send(\n    new GetParameterCommand({\n      Name: id,\n    }),\n  );\n\n  return res?.Parameter?.Value;\n}\n"],"mappings":"yaAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,wBAAAE,EAAA,oBAAAC,EAAA,kBAAAC,EAAA,oBAAAC,IAAA,eAAAC,EAAAN,GCGA,eAAsBO,EACpBC,EACA,CAAE,QAAAC,CAAQ,EACiD,CAC3D,IAAMC,EAAO,IAAI,gBACXC,EAAI,WAAW,IAAMD,EAAK,MAAM,IAAI,MAAM,WAAW,CAAC,EAAGD,CAAO,EAEhEG,EAAM,IAAI,IAAI,0CAA0C,EAC9DA,EAAI,aAAa,IAAI,WAAYJ,CAAE,EAEnC,GAAI,CACF,IAAMK,EAAM,MAAM,MAAMD,EAAK,CAC3B,OAAQ,MACR,QAAS,CAEP,iCAAkC,QAAQ,IAAI,mBAAqB,EACrE,EACA,OAAQF,EAAK,MACf,CAAC,EAED,GAAI,CAACG,EAAI,GAAI,CAEX,IAAMC,EAAO,MAAMD,EAAI,KAAK,EAAE,MAAM,IAAM,EAAE,EAC5C,MAAM,IAAI,MAAM,mBAAmBA,EAAI,MAAM,KAAKC,EAAK,MAAM,EAAG,GAAG,CAAC,EAAE,CACxE,CAEA,IAAMC,EAAQ,MAAMF,EAAI,KAAK,EAC7B,MAAO,CACL,OAAQE,GAAM,aACd,OAAQA,GAAM,aAAe,OAAO,KAAKA,GAAM,YAAY,EAAI,MACjE,CACF,QAAE,CACA,aAAaJ,CAAC,CAChB,CACF,CAEA,eAAsBK,EACpBR,EACA,CAAE,QAAAC,CAAQ,EACmB,CAC7B,IAAMC,EAAO,IAAI,gBACXC,EAAI,WAAW,IAAMD,EAAK,MAAM,IAAI,MAAM,WAAW,CAAC,EAAGD,CAAO,EAEhEG,EAAM,IAAI,IAAI,qDAAqD,EACzEA,EAAI,aAAa,IAAI,OAAQJ,CAAE,EAE/B,GAAI,CACF,IAAMK,EAAM,MAAM,MAAMD,EAAK,CAC3B,OAAQ,MACR,QAAS,CAEP,iCAAkC,QAAQ,IAAI,mBAAqB,EACrE,EACA,OAAQF,EAAK,MACf,CAAC,EAED,GAAI,CAACG,EAAI,GAAI,CAEX,IAAMC,EAAO,MAAMD,EAAI,KAAK,EAAE,MAAM,IAAM,EAAE,EAC5C,MAAM,IAAI,MAAM,mBAAmBA,EAAI,MAAM,KAAKC,EAAK,MAAM,EAAG,GAAG,CAAC,EAAE,CACxE,CAGA,OADc,MAAMD,EAAI,KAAK,IAChB,WAAW,KAC1B,QAAE,CACA,aAAaF,CAAC,CAChB,CACF,CCtEA,IAAAM,EAA4D,2CAC5DC,EAA+C,+BAEzCC,EAAU,IAAI,uBACdC,EAAM,IAAI,YAEhB,eAAsBC,EAAeC,EAAuE,CAC1G,IAAMC,EAAM,MAAMJ,EAAQ,KACxB,IAAI,wBAAsB,CACxB,SAAUG,CACZ,CAAC,CACH,EAEA,MAAO,CACL,OAAQC,GAAK,aACb,OAAQA,GAAK,aAAe,OAAO,KAAKA,GAAK,YAAY,EAAI,MAC/D,CACF,CAEA,eAAsBC,EAAkBF,EAAyC,CAO/E,OANY,MAAMF,EAAI,KACpB,IAAI,sBAAoB,CACtB,KAAME,CACR,CAAC,CACH,IAEY,WAAW,KACzB,CFxBA,IAAMG,EAAsB,GAE5B,eAAsBC,EACpBC,EACAC,EAG6B,CAC7B,GAAI,CACF,IAAMC,EAAM,MAAMC,EAA4BH,EAAI,CAChD,QAASC,GAAM,SAAWH,CAC5B,CAAC,EAED,GAAI,OAAOI,GAAK,QAAW,SACzB,OAAOA,EAAI,MAEf,MAAQ,CACN,IAAMA,EAAM,MAAME,EAAeJ,CAAE,EAEnC,GAAI,OAAOE,GAAK,QAAW,SACzB,OAAOA,EAAI,MAEf,CAGF,CAEA,eAAsBG,EACpBL,EACAC,EAG6B,CAC7B,GAAI,CACF,IAAMC,EAAM,MAAMC,EAA4BH,EAAI,CAChD,QAASC,GAAM,SAAWH,CAC5B,CAAC,EAED,GAAII,GAAK,kBAAkB,OACzB,OAAOA,EAAI,MAEf,MAAQ,CACN,IAAMA,EAAM,MAAME,EAAeJ,CAAE,EAEnC,GAAIE,GAAK,kBAAkB,OACzB,OAAOA,EAAI,MAEf,CAGF,CAEA,eAAsBI,EACpBN,EACAC,EAGwB,CACxB,IAAMM,EAAQ,MAAMR,EAAgBC,EAAIC,CAAI,EAC5C,OAAOM,EAAS,KAAK,MAAMA,CAAK,EAAU,MAC5C,CAEA,eAAsBC,EACpBR,EACAC,EAG6B,CAC7B,GAAI,CACF,IAAMC,EAAM,MAAMO,EAA+BT,EAAI,CACnD,QAASC,GAAM,SAAWH,CAC5B,CAAC,EAED,GAAI,OAAOI,GAAQ,SACjB,OAAOA,CAEX,MAAQ,CACN,IAAMA,EAAM,MAAMQ,EAAkBV,CAAE,EAEtC,GAAI,OAAOE,GAAQ,SACjB,OAAOA,CAEX,CAGF","names":["index_exports","__export","getParameterString","getSecretBinary","getSecretJSON","getSecretString","__toCommonJS","getSecretValueFromExtension","id","timeout","ctrl","t","url","res","body","json","getParameterValueFromExtension","import_client_secrets_manager","import_client_ssm","secrets","ssm","getSecretValue","id","res","getParameterValue","EXT_DEFAULT_TIMEOUT","getSecretString","id","opts","res","getSecretValueFromExtension","getSecretValue","getSecretBinary","getSecretJSON","value","getParameterString","getParameterValueFromExtension","getParameterValue"]}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "aws-lambda-secrets",
+  "version": "0.1.0",
+  "description": "Fetch secrets from AWS Secrets Manager or Parameter Store during Lambda's runtime",
+  "main": "dist/index.js",
+  "files": [
+    "./dist"
+  ],
+  "author": "jdrydn <james@jdrydn.com> (https://github.com/jdrydn)",
+  "license": "MIT",
+  "keywords": [
+    "aws",
+    "lambda",
+    "secrets",
+    "manager",
+    "parameter",
+    "store"
+  ],
+  "dependencies": {
+    "@aws-sdk/client-secrets-manager": "^3.980.0",
+    "@aws-sdk/client-ssm": "^3.980.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.2.0",
+    "@vitest/coverage-v8": "^4.0.18",
+    "aws-sdk-client-mock": "^4.1.0",
+    "msw": "^2.12.7",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test:unit": "vitest run --coverage"
+  }
+}