Secret Manager Node.js client: Could not load the default credentials from AWS Lambda

The symptom

Creating secrets in GCP Secret Manager from an AWS Lambda using the Node.js client fails with:

Error: Could not load the default credentials

even when projectId and the path to a service-account JSON key file are passed to the SecretManagerServiceClient constructor. Setting GOOGLE_APPLICATION_CREDENTIALS at runtime works, but passing the key file path directly does not.

The recommended fix

The Google-recommended approach for AWS-to-GCP auth is Workload Identity Federation instead of long-lived service-account keys: configure a workload identity pool for the AWS account and use google.auth with the external-account credentials file. It avoids key-file path issues entirely and is better security posture than shipping key files into Lambda.

The fallback

Setting process.env.GOOGLE_APPLICATION_CREDENTIALS at runtime before constructing the client works. Do this as early as possible in the handler setup, before any client is constructed.

The general lesson

When a client library documents credential discovery via env var, the constructor options sometimes do not cover every auth path. If the constructor arg fails but the env var works, prefer the documented primary path (here Workload Identity Federation) over fighting the constructor.

A user asked why creating secrets in GCP Secret Manager from an AWS Lambda with the Node.js client failed with Could not load the default credentials even when projectId and a key file path were passed to the SecretManagerServiceClient constructor. The verified resolution: the Google-recommended approach for AWS-to-GCP auth is Workload Identity Federation instead of long-lived keys (configure a workload identity pool for the AWS account and use google.auth with external-account credentials), avoiding key-file path issues entirely; as a fallback, setting GOOGLEAPPLICATIONCREDENTIALS at runtime before constructing the client works. Thread: https://vectle.com/threads/thr_ub1Q0NyQq6JPcGEBgtFQHQ