mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
86 lines
2.1 KiB
Markdown
86 lines
2.1 KiB
Markdown
---
|
|
name: aws-secrets-manager
|
|
description: Store and rotate secrets in AWS Secrets Manager. Configure automatic rotation, access policies, and application integration. Use when managing secrets in AWS environments or requiring automatic credential rotation.
|
|
license: MIT
|
|
metadata:
|
|
author: devops-skills
|
|
version: "1.0"
|
|
---
|
|
|
|
# AWS Secrets Manager
|
|
|
|
Securely store, manage, and rotate secrets in AWS.
|
|
|
|
## When to Use This Skill
|
|
|
|
Use this skill when:
|
|
- Storing database credentials
|
|
- Managing API keys in AWS
|
|
- Implementing automatic secret rotation
|
|
- Integrating secrets with AWS services
|
|
|
|
## Prerequisites
|
|
|
|
- AWS account
|
|
- AWS CLI configured
|
|
- IAM permissions for Secrets Manager
|
|
|
|
## Basic Operations
|
|
|
|
```bash
|
|
# Create secret
|
|
aws secretsmanager create-secret \
|
|
--name myapp/database \
|
|
--secret-string '{"username":"admin","password":"secret123"}'
|
|
|
|
# Get secret
|
|
aws secretsmanager get-secret-value --secret-id myapp/database
|
|
|
|
# Update secret
|
|
aws secretsmanager put-secret-value \
|
|
--secret-id myapp/database \
|
|
--secret-string '{"username":"admin","password":"newpassword"}'
|
|
|
|
# Delete secret
|
|
aws secretsmanager delete-secret --secret-id myapp/database --recovery-window-in-days 7
|
|
```
|
|
|
|
## Automatic Rotation
|
|
|
|
```bash
|
|
# Enable rotation with Lambda
|
|
aws secretsmanager rotate-secret \
|
|
--secret-id myapp/database \
|
|
--rotation-lambda-arn arn:aws:lambda:region:account:function:rotation-function \
|
|
--rotation-rules AutomaticallyAfterDays=30
|
|
```
|
|
|
|
## Application Integration
|
|
|
|
```python
|
|
import boto3
|
|
import json
|
|
|
|
def get_secret(secret_name):
|
|
client = boto3.client('secretsmanager')
|
|
response = client.get_secret_value(SecretId=secret_name)
|
|
return json.loads(response['SecretString'])
|
|
|
|
# Usage
|
|
creds = get_secret('myapp/database')
|
|
db_connect(creds['username'], creds['password'])
|
|
```
|
|
|
|
## Best Practices
|
|
|
|
- Enable automatic rotation
|
|
- Use resource-based policies
|
|
- Enable encryption with KMS
|
|
- Implement least-privilege access
|
|
- Use versioning for rollback
|
|
|
|
## Related Skills
|
|
|
|
- [hashicorp-vault](../hashicorp-vault/) - Multi-cloud secrets
|
|
- [aws-iam](../../../infrastructure/cloud-aws/aws-iam/) - IAM policies
|