How to integrate AWS Secrets Manager with Django

To integrate AWS Secrets Manager with your Django application, you will typically follow these steps:

1. Set Up AWS Secrets Manager

First, create a secret in AWS Secrets Manager. This will hold sensitive information (e.g., database credentials, API keys) that you want to securely access in your Django project.

Steps to create a secret in AWS Secrets Manager:

1. Log in to AWS Console and navigate to Secrets Manager.
2. Click Store a new secret.
3. Choose Other type of secrets (or select the appropriate type depending on what you're storing, e.g., database credentials).
4. Enter your secret data. For example, if you're storing database credentials, you might add:

{
    "DB_HOST": "your-database-endpoint",
    "DB_NAME": "your-db-name",
    "DB_USER": "your-db-user",
    "DB_PASSWORD": "your-db-password"
}

5. Click Next to configure other settings like secret name and rotation (optional).

6. Click Store to save your secret.

After this step, you'll have a secret stored in AWS Secrets Manager with the relevant data.

2. Set Up Your Django Application

To securely fetch the secret from AWS Secrets Manager, you will need the AWS SDK (boto3) in your Django project.

Steps to integrate Secrets Manager into Django:

1. Install Required Packages:

First, you'll need to install boto3 (AWS SDK for Python) and python-dotenv to manage your environment variables (if needed).

pip install boto3 python-dotenv

2. Configure AWS Credentials:

Ensure your AWS credentials are set up either by:

Setting environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION).
Using the AWS CLI (aws configure) to configure credentials.
Using IAM roles if running on AWS (e.g., EC2, Lambda).

3. Create a secrets.py Utility File:

Create a utility file (e.g., secrets.py) to interact with AWS Secrets Manager and fetch the secrets.

import boto3
import json
from botocore.exceptions import ClientError

def get_secret(secret_name):
    region_name = "us-east-1"  # Change to your region
    
    # Create a Secrets Manager client
    session = boto3.session.Session()
    client = session.client(service_name="secretsmanager", region_name=region_name)

    try:
        # Retrieve the secret value from AWS Secrets Manager
        get_secret_value_response = client.get_secret_value(SecretId=secret_name)

    except ClientError as e:
        raise Exception(f"Unable to retrieve secret: {e}")
    
    # Secrets Manager decrypts the secret value
    secret = get_secret_value_response['SecretString']
    return json.loads(secret)

get_secret function retrieves the secret and returns it as a Python dictionary.

4. Access the Secret in Django Settings:

Now that you have a method to fetch the secret, you can integrate this into your Django settings. Open settings.py and modify the database configuration to pull from the secret.

from .secrets import get_secret

# Retrieve database credentials from AWS Secrets Manager
secret = get_secret("your-secret-name")

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql_psycopg2',
        'NAME': secret['DB_NAME'],
        'USER': secret['DB_USER'],
        'PASSWORD': secret['DB_PASSWORD'],
        'HOST': secret['DB_HOST'],
        'PORT': '5432',  # or the relevant port for your DB
    }
}

Replace "your-secret-name" with the actual secret name you created in Secrets Manager.
The secret is returned as a dictionary, which you can use to fill the values in the DATABASES setting.

5. Optional: Store AWS Credentials Using .env:

If you want to manage your AWS credentials outside of the environment (useful for local development), you can store them in a .env file. First, install the python-dotenv package:

pip install python-dotenv

Then, create a .env file:

AWS_ACCESS_KEY_ID=your-access-key-id
AWS_SECRET_ACCESS_KEY=your-secret-access-key
AWS_DEFAULT_REGION=us-east-1

In secrets.py, load the environment variables using python-dotenv:

from dotenv import load_dotenv
load_dotenv()

import boto3
import json
from botocore.exceptions import ClientError

def get_secret(secret_name):
    region_name = os.getenv("AWS_DEFAULT_REGION")
    
    session = boto3.session.Session()
    client = session.client(service_name="secretsmanager", region_name=region_name)

    try:
        get_secret_value_response = client.get_secret_value(SecretId=secret_name)
    except ClientError as e:
        raise Exception(f"Unable to retrieve secret: {e}")
    
    secret = get_secret_value_response['SecretString']
    return json.loads(secret)

6. Deploying to AWS (Optional):

If you're deploying to an EC2 instance or using another AWS service, make sure that:

The EC2 instance has the necessary IAM role to access Secrets Manager.

The IAM role should have secretsmanager:GetSecretValue permissions for the secret.

Example of the Complete Integration:

Let's summarize the complete flow:

Store secret in AWS Secrets Manager (with a key-value structure like DB_HOST, DB_NAME, etc.).
Install dependencies: Install boto3 and python-dotenv for AWS interaction and environment management.
Create secrets.py to fetch secrets securely from AWS Secrets Manager.
Modify settings.py in Django to use these secrets for database configuration.

Now your Django application will retrieve sensitive configuration (such as database credentials) from AWS Secrets Manager at runtime, keeping them secure and out of your codebase.

Testing:

To test the integration, run your Django application or shell:

python manage.py runserver

Make sure your AWS credentials are correctly set and accessible by the application. If everything is set up correctly, Django should connect to your database using the credentials retrieved from AWS Secrets Manager.

Conclusion:

This approach ensures that your sensitive information is securely stored in AWS Secrets Manager, and it allows your Django application to access it in a safe and automated manner. You avoid hardcoding sensitive information in your settings.py file, reducing the risk of exposing credentials in version control systems.

Search This Blog

Knowledge Factory