.

security/secrets/aws-secrets-manager/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: aws-secrets-manager
+description: Store and rotate secrets in AWS Secrets Manager. Configure automatic rotation, access policies, and application integration. Use when managing secrets in AWS environments or requiring automatic credential rotation.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# AWS Secrets Manager
+
+Securely store, manage, and rotate secrets in AWS.
+
+## When to Use This Skill
+
+Use this skill when:
+- Storing database credentials
+- Managing API keys in AWS
+- Implementing automatic secret rotation
+- Integrating secrets with AWS services
+
+## Prerequisites
+
+- AWS account
+- AWS CLI configured
+- IAM permissions for Secrets Manager
+
+## Basic Operations
+
+```bash
+# Create secret
+aws secretsmanager create-secret \
+  --name myapp/database \
+  --secret-string '{"username":"admin","password":"secret123"}'
+
+# Get secret
+aws secretsmanager get-secret-value --secret-id myapp/database
+
+# Update secret
+aws secretsmanager put-secret-value \
+  --secret-id myapp/database \
+  --secret-string '{"username":"admin","password":"newpassword"}'
+
+# Delete secret
+aws secretsmanager delete-secret --secret-id myapp/database --recovery-window-in-days 7
+```
+
+## Automatic Rotation
+
+```bash
+# Enable rotation with Lambda
+aws secretsmanager rotate-secret \
+  --secret-id myapp/database \
+  --rotation-lambda-arn arn:aws:lambda:region:account:function:rotation-function \
+  --rotation-rules AutomaticallyAfterDays=30
+```
+
+## Application Integration
+
+```python
+import boto3
+import json
+
+def get_secret(secret_name):
+    client = boto3.client('secretsmanager')
+    response = client.get_secret_value(SecretId=secret_name)
+    return json.loads(response['SecretString'])
+
+# Usage
+creds = get_secret('myapp/database')
+db_connect(creds['username'], creds['password'])
+```
+
+## Best Practices
+
+- Enable automatic rotation
+- Use resource-based policies
+- Enable encryption with KMS
+- Implement least-privilege access
+- Use versioning for rollback
+
+## Related Skills
+
+- [hashicorp-vault](../hashicorp-vault/) - Multi-cloud secrets
+- [aws-iam](../../../infrastructure/cloud-aws/aws-iam/) - IAM policies

security/secrets/aws-secrets-manager/references/secrets-patterns.md

@@ -0,0 +1,115 @@
+# AWS Secrets Manager Patterns
+
+## Basic Operations
+
+```bash
+# Create secret
+aws secretsmanager create-secret \
+  --name myapp/database \
+  --secret-string '{"username":"admin","password":"secret123"}'
+
+# Get secret
+aws secretsmanager get-secret-value --secret-id myapp/database
+
+# Update secret
+aws secretsmanager update-secret \
+  --secret-id myapp/database \
+  --secret-string '{"username":"admin","password":"newsecret"}'
+
+# Delete secret
+aws secretsmanager delete-secret --secret-id myapp/database --force-delete-without-recovery
+```
+
+## Automatic Rotation
+
+```python
+# Lambda rotation function
+def lambda_handler(event, context):
+    secret_id = event['SecretId']
+    token = event['ClientRequestToken']
+    step = event['Step']
+    
+    if step == "createSecret":
+        create_secret(secret_id, token)
+    elif step == "setSecret":
+        set_secret(secret_id, token)
+    elif step == "testSecret":
+        test_secret(secret_id, token)
+    elif step == "finishSecret":
+        finish_secret(secret_id, token)
+```
+
+## Terraform
+
+```hcl
+resource "aws_secretsmanager_secret" "db" {
+  name = "myapp/database"
+  
+  tags = {
+    Environment = "production"
+  }
+}
+
+resource "aws_secretsmanager_secret_version" "db" {
+  secret_id = aws_secretsmanager_secret.db.id
+  secret_string = jsonencode({
+    username = "admin"
+    password = random_password.db.result
+  })
+}
+
+# Rotation
+resource "aws_secretsmanager_secret_rotation" "db" {
+  secret_id           = aws_secretsmanager_secret.db.id
+  rotation_lambda_arn = aws_lambda_function.rotation.arn
+  
+  rotation_rules {
+    automatically_after_days = 30
+  }
+}
+```
+
+## Application Integration
+
+### Python (boto3)
+```python
+import boto3
+import json
+
+def get_secret(secret_name):
+    client = boto3.client('secretsmanager')
+    response = client.get_secret_value(SecretId=secret_name)
+    return json.loads(response['SecretString'])
+
+# Usage
+creds = get_secret('myapp/database')
+connection = connect(
+    host=creds['host'],
+    user=creds['username'],
+    password=creds['password']
+)
+```
+
+### ECS Task Definition
+```json
+{
+  "containerDefinitions": [{
+    "secrets": [{
+      "name": "DATABASE_PASSWORD",
+      "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789:secret:myapp/database:password::"
+    }]
+  }]
+}
+```
+
+### Lambda
+```yaml
+# SAM template
+Environment:
+  Variables:
+    SECRET_ARN: !Ref DatabaseSecret
+    
+Policies:
+  - AWSSecretsManagerGetSecretValuePolicy:
+      SecretArn: !Ref DatabaseSecret
+```