title: Accessing AWS APIs from within a lambda function?
body: <p>I'm writing my first lambda function (in Python), and I'm a little confused about how credentials are supposed to work in the lambda environment.  I'm trying to retrieve a secret (for Aurora database access) from the aws secrets api, using their example code which looks something like this (I've stripped out all the error handling for brevity):</p>
  
  <pre><code>def get_secret():
      secret_name = 'dbtest-postgres-secret'
      region_name = 'us-east-2'
  
      session = boto3.session.Session()                                                                                                                                                          
      client = session.client(                                                                                                                                                                   
          service_name='secretsmanager',                                                                                                                                                         
          region_name=region_name                                                                                                                                                                
      )                                                                                                                                                                                          
  
      get_secret_value_response = client.get_secret_value(                                                                                                                                   
          SecretId=secret_name                                                                                                                                                               
      )                                                                                                                                                                                      
  
      secret = get_secret_value_response['SecretString']
  
      return secret
  </code></pre>
  
  <p>This works fine locally in an environment in which I have my normal AWS credentials, but returns None without raising any errors when running as part of a lambda function.  I'm using it like this:</p>
  
  <pre><code>def handler(event, context):
      secret = get_secret()
      assert secret is not None
  </code></pre>
  
  <p>And it's failing at that <code>assert</code> statement:</p>
  
  <pre><code>{
    "errorType": "AssertionError",
    "stackTrace": [
      "  File \"/var/task/dbtest.py\", line nn, in handler\n    assert secret is not None\n"
    ]
  }
  </code></pre>
  
  <p>I assumed that by assigning a role to the lambda function with appropriate permissions (<code>AmazonRDSDataFullAccess</code>, which includes permissions to access the secrets manager) that everything would be set. Do I need to provide explicit credentials (e.g., an access key and secret) to the lambda function?</p>