// BAD: Environment variables with secrets
const lambda = new lambda.Function(this, 'Handler', {
  environment: {
    SLACK_TOKEN: 'xoxb-...',                    // Secret in code
    API_KEY: process.env.API_KEY,               // Secret from env
    DB_PASSWORD: ssm.StringParameter.valueForStringParameter(this, '/db/password') // Injected at deploy
  }
});

// GOOD: No secrets in infrastructure
const lambda = new lambda.Function(this, 'Handler', {
  environment: {
    CONFIG_PROFILE: 'production',  // Non-sensitive selector only
    AWS_REGION: 'us-east-1'        // Public information only
  }
});

// Grant IAM permissions for runtime access
lambda.addToRolePolicy(new iam.PolicyStatement({
  effect: iam.Effect.ALLOW,
  actions: ['ssm:GetParameter', 'ssm:GetParameters'],
  resources: [
    `arn:aws:ssm:${this.region}:${this.account}:parameter/slack-bot/production/*`
  ]
}));

// runtime/handlers/slack-bot/index.ts
import { SSMClient, GetParameterCommand } from '@aws-sdk/client-ssm';

const ssm = new SSMClient({});

async function getSecret(name: string): Promise<string> {
  const command = new GetParameterCommand({
    Name: name,
    WithDecryption: true
  });
  const response = await ssm.send(command);
  return response.Parameter!.Value!;
}

export async function handler(event: any) {
  // Hardcoded path - no environment variable needed
  const slackToken = await getSecret('/slack-bot/production/token');
  // Use the token...
}

// Grant access to specific application path only
lambda.addToRolePolicy(new iam.PolicyStatement({
  effect: iam.Effect.ALLOW,
  actions: ['ssm:GetParameter', 'ssm:GetParameters'],
  resources: [
    // Application-specific path only
    `arn:aws:ssm:${region}:${account}:parameter/slack-bot/production/*`
  ],
  conditions: {
    StringEquals: {
      'aws:RequestedRegion': region
    }
  }
}));

import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';

const client = new SecretsManagerClient({});

async function getSecret(secretId: string): Promise<string> {
  const command = new GetSecretValueCommand({ SecretId: secretId });
  const response = await client.send(command);
  return response.SecretString!;
}

environment: {
  CONFIG_PROFILE: 'production',      // Environment selector
  AWS_REGION: 'us-east-1',           // Public information
  LOG_LEVEL: 'info',                 // Non-sensitive config
  FEATURE_FLAG_XYZ: 'true',          // Feature toggles
  MAX_RETRY_ATTEMPTS: '3'            // Non-sensitive parameters
}

environment: {
  SLACK_TOKEN: 'xoxb-...',           // Secret value
  API_KEY: 'sk-...',                 // Secret value
  DB_PASSWORD: 'password123',        // Secret value
  PARAM_PATH: '/slack-bot/token',    // Even paths are not allowed
  SECRET_NAME: 'slack-token'         // Secret identifiers
}

// GOOD: Path is in code, not in environment
const token = await getSecret('/slack-bot/production/token');

// BAD: Path comes from environment
const token = await getSecret(process.env.PARAM_PATH!);

const handler = new lambda.Function(this, 'SlackBotHandler', {
  // ... function config
});

// Specific permission for Parameter Store
handler.addToRolePolicy(new iam.PolicyStatement({
  effect: iam.Effect.ALLOW,
  actions: ['ssm:GetParameter'],
  resources: [
    `arn:aws:ssm:${region}:${account}:parameter/slack-bot/production/*`
  ]
}));

// Specific permission for SQS (if needed)
handler.addToRolePolicy(new iam.PolicyStatement({
  effect: iam.Effect.ALLOW,
  actions: ['sqs:SendMessage'],
  resources: [intentQueue.queueArn]
}));

// No broad permissions like s3:*, dynamodb:*, or ssm:*

// Alert on unauthorized access attempts
const unauthorizedAccessMetric = new cloudwatch.Metric({
  namespace: 'AWS/SSM',
  metricName: 'ParameterStoreUnauthorizedAccess',
  statistic: 'Sum'
});

new cloudwatch.Alarm(this, 'UnauthorizedAccess', {
  metric: unauthorizedAccessMetric,
  threshold: 1,
  evaluationPeriods: 1,
  alarmDescription: 'Alert on Parameter Store unauthorized access'
});

const kmsKey = new kms.Key(this, 'SecretsKey', {
  description: 'KMS key for application secrets',
  enableKeyRotation: true
});

// Reference in Parameter Store (created outside CDK)
// aws ssm put-parameter --name /app/secret --value "..." --type SecureString --key-id <key-id>

// BAD
const token = await getSecret('/slack-bot/token');
console.log(`Token: ${token}`);  // Logged to CloudWatch!

// GOOD
const token = await getSecret('/slack-bot/token');
console.log('Token retrieved successfully');

// BAD
catch (error) {
  throw new Error(`Failed to connect with token ${token}`);
}

// GOOD
catch (error) {
  throw new Error('Failed to connect to Slack API');
}

// BAD: Cached in memory indefinitely
let cachedToken: string;
async function getToken() {
  if (!cachedToken) {
    cachedToken = await getSecret('/slack-bot/token');
  }
  return cachedToken;
}

// GOOD: Time-limited cache with refresh
const cache = new Map<string, { value: string, expiresAt: number }>();

async function getToken(): Promise<string> {
  const cached = cache.get('token');
  if (cached && cached.expiresAt > Date.now()) {
    return cached.value;
  }
  
  const value = await getSecret('/slack-bot/token');
  cache.set('token', { 
    value, 
    expiresAt: Date.now() + 5 * 60 * 1000  // 5 minutes
  });
  return value;
}