AWS Secrets Manager with RDS and Lambda: MySQL Integration Lab

Purpose of This Lesson

This lab demonstrates how to connect an AWS Lambda function to an Amazon RDS for MySQL database without placing database connection details directly in the function code. AWS Secrets Manager stores the database credentials and connection metadata, while Lambda retrieves the secret at runtime and uses it to authenticate to MySQL.

The workflow also covers the supporting permissions, networking configuration, Lambda dependency packaging, environment variables, testing, and resource cleanup.

Key Concepts

• Amazon RDS for MySQL: Hosts the sample relational database, named sampleDB in the lab.
• AWS Secrets Manager: Stores the database username, password, engine, endpoint, port, database name, and database identifier in a structured secret.
• AWS Lambda: Retrieves the secret through the AWS SDK for Python (boto3), connects to MySQL, inserts records, and retrieves existing records.
• Lambda layer: Packages the PyMySQL library so the function can make a MySQL connection.
• Lambda execution role: Must have permission to call Secrets Manager. The lab adds the SecretsManagerReadWrite policy, although a narrower read-only policy would be preferable for a function that only retrieves secrets.
• Environment variable: The function uses secret_name=prod/sampledB to identify the secret without hard-coding the credentials.
• Security group: MySQL uses TCP port 3306. The security group must permit the Lambda function’s traffic to reach the database.
• Regional scope: RDS, Secrets Manager, and Lambda resources used in this workflow must be deployed in the same AWS Region. The lab uses US East (N. Virginia).

Technical / Operational Context: Building the Integration

1. Create the RDS database

Create a MySQL RDS instance named sampleDB. The lab uses the free tier, default storage and engine settings, and a manually supplied master username and password. The initial database name is also sampleDB.

The lab makes the database publicly accessible to simplify connectivity. This is a temporary training configuration rather than a recommended production design.

2. Configure network access

The database listens on the standard MySQL port, 3306. The lab updates the attached VPC security group’s inbound rules to allow MySQL traffic from any source so that the Lambda function can reach the publicly accessible database.

This rule is intentionally broad and exposes the database to the internet. A more secure design would keep RDS private and connect Lambda to the VPC, using appropriate subnets and security-group rules. The lecture notes that an alternative VPC-based design is covered in other labs.

3. Create the Secrets Manager secret

After RDS reaches an active, successfully created state, create a new Secrets Manager secret using the Credentials for Amazon RDS database option.

Provide:

• The RDS master username, such as admin
• The same password configured during RDS creation
• The target RDS database
• The secret name prod/sampledB

Secrets Manager automatically stores or retrieves the relevant database connection information, including the endpoint, port, engine, database name, username, and password. The Lambda code can retrieve this data through an API call instead of embedding it in source code.

4. Build the PyMySQL Lambda layer

The Lambda function requires the PyMySQL library. In CloudShell, install the library into a directory and then create a ZIP archive containing it. The resulting ZIP file can be downloaded from CloudShell and uploaded as a Lambda layer.

The layer is named PY MySQL in the lab and is configured for the Python runtime used by the function, specifically Python 3.13. The layer must then be attached to the Lambda function; creating it alone does not make the library available to the function.

5. Create and authorize the Lambda function

Create a Python 3.13 function named RDS Secrets Lab. Update its execution role so it can access Secrets Manager. The lab adds a Secrets Manager read/write policy to the role.

For least privilege, the function’s actual behavior should be considered when selecting permissions: a function that only reads a secret should not generally require write permissions. The important operational requirement demonstrated here is that the execution role must be authorized for the Secrets Manager API call.

Attach the PY MySQL layer under the function’s configuration. Then deploy the supplied Python code without modification.

6. Configure the secret identifier

Add this environment variable:

Name: secret_name
Value: prod/sampledB

The code reads this variable, calls Secrets Manager through boto3, extracts the endpoint, username, password, and related values, and uses them to establish the MySQL connection.

7. Test database operations

Run a Lambda test event containing the message used by the function. A successful invocation returns HTTP-style status code 200, reports the inserted record ID, and displays the inserted value.

Repeating the test with values such as hello from Lambda, hello from Neil, and hello from DCT demonstrates that the function can insert new records and retrieve existing records from the database.

8. Clean up resources

When the lab is complete:

1. Delete the RDS database.
2. Do not create a final snapshot or retain automated backups if they are not needed for the exercise.
3. Delete the Secrets Manager secret. Secrets Manager requires a recovery waiting period; the minimum configured period is 7 days.
4. Remove the Lambda function and associated lab resources.
5. Review the security group and remove any temporary broad inbound rule.

Exam- or Assessment-Relevant Takeaways

For CloudOps-oriented scenarios, identify the responsibility of each service and the failure point implied by the symptoms:

• Credential storage: Use Secrets Manager rather than embedding a database password in Lambda source code.
• Runtime retrieval: Lambda needs IAM permission to retrieve the secret, and the secret name must match the configured identifier.
• Database discovery: The secret can provide the RDS endpoint and port as well as credentials, allowing the function to construct the connection dynamically.
• Dependency handling: A third-party Python package such as PyMySQL must be included in the deployment package or supplied through a Lambda layer.
• Network reachability: Valid credentials do not help if the security group, public accessibility, VPC configuration, or port settings prevent the function from reaching RDS.
• Region alignment: Resources in different Regions may not be visible or usable in the expected way for this workflow; verify the selected Region first.
• Security tradeoff: Making RDS publicly accessible and allowing port 3306 from any source simplifies the lab but is not the secure production pattern.

Tool / Feature Decision Guide

Requirement	Appropriate choice	Reason
Store RDS credentials for application use	Secrets Manager	Keeps credentials out of Lambda source code and provides structured connection information.
Connect Python Lambda to MySQL	PyMySQL package	Provides the Python MySQL client library required by the function.
Make a dependency available to multiple or separately deployed functions	Lambda layer	Packages the library independently from the function code.
Identify the secret at runtime	Lambda environment variable	The function can refer to secret_name without embedding the secret value.
Simplify connectivity for a temporary lab	Public RDS plus an open MySQL security-group rule	Easy to configure, but exposes the database and should not be treated as a secure production design.
Protect a production database from public exposure	Private RDS with Lambda VPC connectivity and restricted security groups	Avoids direct internet exposure and limits permitted network paths.
Grant a function access to the secret	IAM execution-role permission for Secrets Manager	Lambda uses its execution role when calling AWS APIs.

Common Traps / Misconceptions

• Creating the secret before RDS is active: The database must be successfully created and active before it appears as a selectable target in Secrets Manager.
• Using the wrong secret name: The lab code expects prod/sampledB; a mismatch in the environment variable causes secret lookup problems.
• Forgetting the Lambda layer attachment: Uploading a layer does not automatically make PyMySQL importable by the function.
• Assuming credentials are the only requirement: Lambda also needs IAM permission to retrieve the secret and network access to the RDS endpoint.
• Opening port 3306 broadly in production: Allowing MySQL from any source means internet hosts can attempt to reach the database.
• Confusing a secret reference with the secret value: The environment variable contains the secret name, not the database password.
• Ignoring Region selection: RDS, Secrets Manager, and Lambda should be checked in the same Region used by the lab.
• Leaving temporary resources running: RDS, Lambda, security-group rules, and secrets should be removed after testing to avoid unnecessary exposure and cost.
• Assuming deletion is immediate for the secret: Secrets Manager uses a recovery waiting period, with 7 days as the minimum in this lab.

Real-World Engineer / Analyst Notes

• Prefer private database connectivity and narrowly scoped security-group rules over public accessibility.
• Use the least-privilege IAM policy that matches the function’s actual Secrets Manager operations. The lab’s read/write policy is convenient for demonstration but broader than a read-only retrieval workflow requires.
• Treat the secret name as configuration, not as a credential. The password should remain in Secrets Manager and should not be logged or returned in Lambda responses.
• When troubleshooting, separate the problem into four layers: secret lookup, IAM authorization, network reachability, and MySQL authentication or query behavior.
• Confirm that the PyMySQL package is compatible with the Lambda runtime and architecture selected for the function.
• Remove temporary public ingress rules during cleanup, even if the database itself is scheduled for deletion.

Quick Reference Summary

RDS engine: MySQL
Database identifier: sampleDB
MySQL port: 3306
Secret name: prod/sampledB
Lambda runtime: Python 3.13
Required library: PyMySQL
Lambda environment variable: secret_name=prod/sampledB
AWS SDK used by Python code: boto3

The end-to-end sequence is:

Create active RDS MySQL database
        ↓
Allow required network access
        ↓
Create RDS credentials secret in Secrets Manager
        ↓
Package PyMySQL as a Lambda layer
        ↓
Create Lambda and grant Secrets Manager permissions
        ↓
Attach layer and deploy code
        ↓
Set secret_name environment variable
        ↓
Invoke Lambda and verify database inserts/retrievals
        ↓
Delete lab resources and temporary access rules

Flashcards

Q: A Lambda function must connect to RDS without storing the database password in source code. Which AWS feature should it use?
A: Use AWS Secrets Manager. Lambda retrieves the secret at runtime and uses the returned credentials and connection details to connect to RDS.

Q: What must be true before an RDS database can be selected while creating the Secrets Manager secret?
A: The RDS database must have completed creation and be in an active, successfully created state.

Q: Why does the lab use the secret name prod/sampledB?
A: The supplied Lambda code expects that identifier through the secret_name environment variable. The configured name and the actual Secrets Manager secret name must match.

Q: What information can the RDS-backed secret provide to the Lambda function besides the password?
A: It can provide the username, database engine, RDS endpoint or host name, port, database name, and database identifier.

Q: A Lambda function raises an import error for the MySQL client library. What lab component should be checked first?
A: Check that the PyMySQL package was placed in a ZIP archive, published as a Lambda layer, and attached to the function.

Q: When would a Lambda layer be preferable to placing PyMySQL directly in the function package?
A: A layer separates the dependency from the function code and can make the library reusable across functions. It still must be attached to each function that needs it.

Q: What IAM capability does the Lambda execution role need in this workflow?
A: It needs permission to call Secrets Manager to retrieve the secret. The lab adds a Secrets Manager read/write policy, though retrieval-only code should use narrower permissions where possible.

Q: A secret exists and the credentials are correct, but Lambda cannot connect to RDS. What category of issue should be investigated?
A: Investigate network reachability, including public accessibility or VPC configuration, security-group rules, and access to TCP port 3306.

Q: Why is allowing MySQL port 3306 from any source a security concern?
A: It permits hosts across the internet to attempt connections to the database. The lab uses it only to simplify temporary connectivity; a production design should restrict the network path.

Q: What is the purpose of the secret_name Lambda environment variable?
A: It identifies which Secrets Manager secret the code should retrieve. It contains the secret’s name, not the password itself.

Q: Why should the RDS, Secrets Manager, and Lambda resources be checked for the same Region?
A: The lab’s service interactions are regional, so using the same Region ensures the expected RDS database and secret are available to the deployed function.

Q: What successful result does the test invocation demonstrate?
A: A status code of 200, an inserted record ID, and the inserted value demonstrate that Lambda retrieved the secret, connected to MySQL, and performed the database operation.

Q: What is the cleanup limitation for a Secrets Manager secret in this lab?
A: Secret deletion uses a recovery waiting period, and the minimum configured period is 7 days rather than immediate deletion.

Practice Questions

Question 1

A Lambda function returns an authorization error when it attempts to retrieve prod/sampledB. The secret exists and the environment variable is correct. What is the most likely cause?

A. The RDS database is using port 3306
B. The Lambda execution role lacks the required Secrets Manager permission
C. The PyMySQL layer is attached to the function
D. The database has an initial database name of sampleDB

Correct answer: B

The decisive clue is an authorization error during secret retrieval, which points to the Lambda execution role rather than MySQL networking or the Python dependency.

Question 2

An engineer wants to reproduce the lab in production but does not want the RDS database exposed to the internet. Which design best addresses that concern?

A. Keep RDS public and allow port 3306 from any source
B. Store the password in a Lambda environment variable instead
C. Keep RDS private and configure Lambda for VPC connectivity with restricted security groups
D. Remove the Secrets Manager secret after every invocation

Correct answer: C

The lecture identifies VPC-based Lambda connectivity as the more secure alternative to public RDS access and an unrestricted inbound rule.

Question 3

The Lambda function can retrieve the secret successfully but fails with No module named PyMySQL. What should the operator verify?

A. That the RDS instance has a public IP address only
B. That the secret deletion waiting period is set to 7 days
C. That the PyMySQL ZIP was published as a layer and attached to the function
D. That the database name is stored in the environment variable

Correct answer: C

Secret retrieval and Python dependency loading are separate steps. The missing module indicates that the dependency package or its layer attachment is incorrect.

Question 4

The Lambda code retrieves a secret but reports that the secret cannot be found. Which configuration should be compared directly?

A. The Lambda runtime and RDS storage type
B. The security-group description and the CloudShell working directory
C. The secret_name environment-variable value and the actual Secrets Manager secret name
D. The RDS final snapshot setting and the Lambda test event name

Correct answer: C

The lab’s code expects secret_name=prod/sampledB; a naming mismatch prevents it from locating the intended secret.

Question 5

A test invocation inserts a record and returns status code 200, but the operator wants to confirm that prior records remain available. Which behavior from the lab provides that verification?

A. Creating a second Lambda layer
B. Repeating the test with a different message and reviewing the returned existing values
C. Changing the RDS engine from MySQL to another engine
D. Deleting and recreating the secret before every test

Correct answer: B

The lab invokes the function with multiple values and observes both the newly inserted record and older records retrieved from the database.

WordPress Metadata

Suggested Slug:
aws-secrets-manager-rds-lambda-mysql-lab

Meta Description:
A practical AWS CloudOps study guide for connecting a Lambda function to an RDS MySQL database with Secrets Manager, IAM permissions, a PyMySQL layer, testing, and cleanup.

Tags:
AWS Certified CloudOps Engineer, AWS Secrets Manager, Amazon RDS, AWS Lambda, MySQL, IAM permissions, Lambda layers, CloudShell, security groups