AWS Secrets Manager

Securely store, manage, and rotate secrets in AWS.

When to Use This Skill

Use this skill when:

• Storing database credentials

• Managing API keys in AWS

• Implementing automatic secret rotation

• Integrating secrets with AWS services

Prerequisites

• AWS account

• AWS CLI configured

• IAM permissions for Secrets Manager

Basic Operations

Create secret

aws secretsmanager create-secret
--name myapp/database
--secret-string '{"username":"admin","password":"secret123"}'

Get secret

aws secretsmanager get-secret-value --secret-id myapp/database

Update secret

aws secretsmanager put-secret-value
--secret-id myapp/database
--secret-string '{"username":"admin","password":"newpassword"}'

Delete secret

aws secretsmanager delete-secret --secret-id myapp/database --recovery-window-in-days 7

Automatic Rotation

Enable rotation with Lambda

aws secretsmanager rotate-secret
--secret-id myapp/database
--rotation-lambda-arn arn:aws:lambda:region:account:function:rotation-function
--rotation-rules AutomaticallyAfterDays=30

Application Integration

import boto3 import json

def get_secret(secret_name): client = boto3.client('secretsmanager') response = client.get_secret_value(SecretId=secret_name) return json.loads(response['SecretString'])

Usage

creds = get_secret('myapp/database') db_connect(creds['username'], creds['password'])

Best Practices

• Enable automatic rotation

• Use resource-based policies

• Enable encryption with KMS

• Implement least-privilege access

• Use versioning for rollback

Related Skills

• hashicorp-vault - Multi-cloud secrets

• aws-iam - IAM policies