A AWS Lambda function that acts as a secure proxy for the Google Custom Search API. It uses AWS KMS to encrypt and protect API credentials, and exposes a simple REST endpoint via API Gateway.

• Overview
• Architecture
• Prerequisites
• Setup & Deployment
• API Usage
• Environment Variables
• Security

This Lambda function:

• Accepts search queries via HTTP GET requests
• Decrypts KMS-encrypted Google API credentials at runtime
• Proxies requests to the Google Custom Search API
• Returns results to the caller with CORS headers enabled

Client → API Gateway → Lambda Function → Google Custom Search API
                          ↑
                       AWS KMS
                  (credential decryption)

• AWS CLI configured with appropriate permissions
• Terraform installed
• A Google Custom Search Engine with:
  • An API Key
  • A Search Engine ID (cx)
• Python 3.x (for Lambda runtime)

cd lambda
zip lambda_function.zip lambda_function.py

cd ../terraform
terraform init
terraform plan
terraform apply

KMS_KEY_ID=$(terraform output -raw kms_key_id)

./encrypt_credentials.sh

This script will use the KMS key to encrypt your GOOGLE_API_KEY and SEARCH_ENGINE_ID.

Add the encrypted values to terraform.tfvars:

encrypted_google_api_key  = "<base64-encrypted-value>"
encrypted_search_engine_id = "<base64-encrypted-value>"

terraform apply

terraform output api_endpoint

Use this endpoint in your application configuration (see application.yml).

GET https://<api-id>.execute-api.<region>.amazonaws.com/search

curl "https://<api-id>.execute-api.us-east-1.amazonaws.com/search?q=aws+lambda&num=5"

{
  "kind": "customsearch#search",
  "items": [
    {
      "title": "AWS Lambda – Serverless Compute",
      "link": "https://aws.amazon.com/lambda/",
      "snippet": "AWS Lambda lets you run code without provisioning or managing servers..."
    }
  ]
}

These are set automatically by Terraform after encryption:

In your Spring Boot or other application, configure the proxy endpoint via application.yml:

google:
  search:
    proxy:
      endpoint: ${GOOGLE_SEARCH_PROXY_ENDPOINT:https://your-api-id.execute-api.us-east-1.amazonaws.com/search}

The endpoint can be overridden at runtime using the GOOGLE_SEARCH_PROXY_ENDPOINT environment variable.

• KMS Encryption: API credentials are never stored in plaintext. They are encrypted using AWS KMS and decrypted only at Lambda invocation time.
• IAM Roles: The Lambda execution role should have the minimum required KMS Decrypt permission scoped to the specific key.
• CORS: Currently set to * (allow all origins). Restrict Access-Control-Allow-Origin in production to your specific domain.
• No credential logging: Decrypted credentials are used in-memory only and never logged.